Fine-Grained Authorization
Fine-Grained Authorization (FGA)
How Fine-Grained Authorization (FGA) works in Paycux, what it is for, and the smallest setup that gets it running.
Introduction
Fine-Grained Authorization (FGA) is part of the Paycux platform. This page explains what it does, when to reach for it, and the smallest working setup you can ship.
Everything below applies to both environments. Build and test in staging, then promote the same configuration to production without changing your code — only the API key and client ID differ.
Core concepts
Core concepts is handled by Fine-Grained Authorization (FGA) rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.
Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.
Building blocks
Building blocks is handled by Fine-Grained Authorization (FGA) rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.
Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.
Resource types
Resource types is handled by Fine-Grained Authorization (FGA) rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.
Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.
Resources
Resources is handled by Fine-Grained Authorization (FGA) rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.
Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.
Roles and permissions
Roles are defined once per project and assigned per organization membership, so the same person can be an admin in one organization and a viewer in another.
Check permissions on the server, in the request path, using the permission slug rather than the role name. Role names change; slugs are stable.
Assignments
Assign the users and groups who should have access. Anyone outside the assignment is rejected at the provider, before the request reaches Paycux.
Group names sync as-is. If you use groups to drive roles in your application, map them once in the dashboard under Authorization rather than branching on group names in code.
Access checks
Access checks is handled by Fine-Grained Authorization (FGA) rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.
Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.